CVE-2025-46093 CRITICAL

CVE-2025-46093

Vendor Liquidfiles

Product LiquidFiles

Weakness CWE-732

Published August 4, 2025

Last update August 5, 2025

View on NVD All CVEs

CVSS base score

9.9/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

LiquidFiles before 4.1.2 supports FTP SITE CHMOD for mode 6777 (setuid and setgid), which allows FTPDrop users to execute arbitrary code as root by leveraging the Actionscript feature and the sudoers configuration.

Key dates

02Disclosure timeline

August 4, 2025 CVE published

August 5, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-46093 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/732.html

Related vulnerabilities

04Related CVE

CVE-2026-2254 Hitachi Vantara Pentaho Data Integration & Analytics - Incorrect Permission Assignment for Critical Resource CVE-2022-1316 Incorrect Permission Assignment for Critical Resource in zerotier/zerotierone CVE-2025-61969 CVE-2024-29964 Brocade SANnav versions before v2.3.0a do not correctly set permissions on files, including docker files CVE-2024-27294 dp-golang Go installation could be owned by wrong user